4 ms·

Idk why people keep pushing for this, on a personal dev machine, root is not a problem, and then there is QEMU

by nsonha 5y ago

denkmoon 5y ago
I think you'd be surprised how often the route from dev to prod is "copy it from my machine into the cloud". Good practices start at home.
- eru 5y ago
  Well, it's also a good practice the other way round: If you can make your dev setup model the production setup, that's one less thing to worry about.
  - goodpoint 5y ago
    That's what VMs are for.
    - eru 5y ago
      VMs are one tool for that. But they are neither necessary nor sufficient.
- nsonha 5y ago
  it's docker that requires root, you don't use root yourself
  - denkmoon 5y ago
    It's perfectly possible to use podman rootless. Presumably docker too, but I only have experience with podman. That is, the podman process does not have root privileges. Maybe excessive, maybe a good prophylactic for potentially damaging NPM packages (for example) to not get root on my CI infrastructure.
deleted 5y ago
[deleted]
stavros 5y ago
It certainly is a problem. We want to run local development stacks with Docker, but, since it runs as root, it leaves files into your home directory (database and other files mounted from the guest) that are owned by root, so you can never delete them. It's really bad UX.
- hda111 5y ago
  Rootless Podman does this as well but with the subuid owned files. For instance you run postfix in a container and it has files owned by postfix. You can’t change the files outside of the container. You can make yourself root in the namespace and delete with podman unshare however. But it isn’t optimal from UX perspective either.
- wiredfool 5y ago
  Home directory, /etc, or /root/.ssh/authorized_keys, depending on what arguments you pass to -v.
- nickjj 5y ago
  If you create a user inside of your Dockerfile and switch to that your files will be owned by whoever is assigned to uid:gid 1000:1000 on your dev box if you use a volume mount. This solves the problem in nearly every case because your primary dev box user is almost always going to be 1000:1000. It'll work on native Linux, Windows (WSL) and macOS using Docker Desktop or not. Here's a bunch of complete web app examples of it working: https://github.com/nickjj?tab=repositories&q=docker-*-example https://github.com/nickjj?tab=repositories&q=docker-*-exampl...
  - stavros 5y ago
    Oh, good call, I wasn't doing this because 1000 is not always the user uid, but it's almost always, and at worst you'll need root to delete the files, thanks!
simnalamburt 5y ago
The main motive for me to make podman-apple-silicon was due do Docker Desktop's pricing model change.

Idk why people keep pushing for this, on a personal dev machine, root is not a problem, and then there is QEMU

by nsonha 5y ago

Idk why people keep pushing for this, on a personal dev machine, root is not a problem, and then there is QEMU

I think you'd be surprised how often the route from dev to prod is "copy it from my machine into the cloud". Good practices start at home.

eru 5y ago
Well, it's also a good practice the other way round: If you can make your dev setup model the production setup, that's one less thing to worry about.
- goodpoint 5y ago
  That's what VMs are for.
  - eru 5y ago
    VMs are one tool for that. But they are neither necessary nor sufficient.
nsonha 5y ago
it's docker that requires root, you don't use root yourself
- denkmoon 5y ago
  It's perfectly possible to use podman rootless. Presumably docker too, but I only have experience with podman. That is, the podman process does not have root privileges. Maybe excessive, maybe a good prophylactic for potentially damaging NPM packages (for example) to not get root on my CI infrastructure.

deleted 5y ago

[deleted]

stavros 5y ago

It certainly is a problem. We want to run local development stacks with Docker, but, since it runs as root, it leaves files into your home directory (database and other files mounted from the guest) that are owned by root, so you can never delete them. It's really bad UX.

hda111 5y ago
Rootless Podman does this as well but with the subuid owned files. For instance you run postfix in a container and it has files owned by postfix. You can’t change the files outside of the container. You can make yourself root in the namespace and delete with podman unshare however. But it isn’t optimal from UX perspective either.
wiredfool 5y ago
Home directory, /etc, or /root/.ssh/authorized_keys, depending on what arguments you pass to -v.
nickjj 5y ago
If you create a user inside of your Dockerfile and switch to that your files will be owned by whoever is assigned to uid:gid 1000:1000 on your dev box if you use a volume mount. This solves the problem in nearly every case because your primary dev box user is almost always going to be 1000:1000. It'll work on native Linux, Windows (WSL) and macOS using Docker Desktop or not. Here's a bunch of complete web app examples of it working: https://github.com/nickjj?tab=repositories&q=docker-*-example https://github.com/nickjj?tab=repositories&q=docker-*-exampl...
- stavros 5y ago
  Oh, good call, I wasn't doing this because 1000 is not always the user uid, but it's almost always, and at worst you'll need root to delete the files, thanks!

simnalamburt 5y ago

The main motive for me to make podman-apple-silicon was due do Docker Desktop's pricing model change.